Skip to content
This repository has been archived by the owner on Oct 20, 2021. It is now read-only.

Latest commit

 

History

History
35 lines (24 loc) · 649 Bytes

README.md

File metadata and controls

35 lines (24 loc) · 649 Bytes
Raw

ProcTool

proctool is a proof-of-concept tool implementing "Artifact Tracing via I/O Monitoring".

To know more about it check out the presentation and the demo.

Prerequisites

  • Nix

Installation

$ nix-shell
$ make install

Testing

$ nix-shell
$ make test

Caveats

  • Current implementation is based on strace. A high performance hit is expected.
  • openat and execve are the only supported syscalls.
  • No children of the surveilled process will be monitored after the dead of its parent.